Capslock: Escaping Bad Dependencies
summary
Capslock is a CLI that performs callpath-level analysis of Go code, using function-level call graphs to report concrete capabilities (filesystem, network, unsafe, exec) reachable from a package and emitting structured JSON; results are available via deps.dev integration. Analysis shows most capabilities appear in under 30% of packages, about a third of Go packages fail to build in the analysis environment, and only 3% of Go package updates introduce a new capability — making targeted reviews feasible.
AI-written summary · about
chapters (9)
- 0:00Capslock introduction
- 3:27Why dependency management is complicated
- 7:19Capability model
- 14:26Transitive dependencies
- 20:51Analyzing Go packages
- 24:47Capslock and dep.dev
- 27:13Code reviews with Capslock
- 32:31Future steps for Capslock
- 33:13Q&A
related talks
38mCapslock: Escaping Bad Dependencies
17mUnderstanding Supply Chain Threats with Static Analysis
29mTrust, but Verify: Proactive Security in Open Source
31mContainer Escape: All You Need Is Cap (Capabilities)
23mThe Code You Reviewed is Not the Code You Built
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
45mEssential security checks for your Go project
35mOverview and Recent Developments: Namespaces and Capabilities